Compile the public core contracts.

Run all four contracts

The examples use bounded constructors and fail-closed validation paths, not pseudocode. CI compiles them explicitly with the pinned MSRV.

cargo check -p stateknot-core --examples --locked
cargo run -p stateknot-core --example first_agent --locked
cargo run -p stateknot-core --example typed_tool --locked
cargo run -p stateknot-core --example model_stream --locked
cargo run -p stateknot-core --example protocol_adapter --locked
cargo test -p stateknot-core --test dependency_boundary --locked
cargo test -p stateknot-core --test fixture_catalog --locked
cargo test -p stateknot-core --test public_type_inventory --locked
cargo test -p stateknot-core --test canonical_execution_wires --locked
cargo test -p stateknot-core --test canonical_time --locked
PROPTEST_RNG_SEED=20261008 cargo test -p stateknot-core --test canonical_values --test value_properties --test nested_json_properties --test budget_composite_properties --test graph_state_properties --locked

Know exactly what compiles

first_agent

Immutable Agent and Model descriptors, schema-bound bounded input, restrictive request limits, and a complete finite resolved budget. No Run is admitted and no provider is called.

typed_tool

Typed schemas are generated, canonicalized, digest-pinned, checked by an offline registry, and accepted by ToolAdapter. No Tool attempt or external effect occurs.

model_stream

A finite streaming request and attempt context pass capability checks; five contiguous semantic events become one bounded response through ModelEventAccumulator. The object-safe Model::stream entry compiles without inventing a provider.

protocol_adapter

A closed external request receives trusted schema identity locally, retains a finite caller limit, and rejects injected tenant authority. It is deliberately not an HTTP, MCP, or A2A transport.

Lock the runtime-neutral boundary

The dependency test reads locked Cargo metadata and compares every direct normal and development dependency with the reviewed allowlist. A new, renamed, or target-specific dependency fails CI until the boundary review is updated explicitly.

This gate keeps provider SDKs, async executors, databases, HTTP servers, protocol SDKs, and telemetry exporters out of stateknot-core. Read the complete source guide and draft RFC-0001 for the remaining acceptance gates.

Seal the compatibility evidence corpus

A versioned catalog closes the inventory around all 44 committed Core fixture documents. Each entry pins the exact file bytes with SHA-256, retaining deliberately non-canonical negative vectors; a domain-separated RFC 8785 root binds the ordered path, schema, and digest metadata.

Complete Tool authorization receipts and Skill approval, open-request, acting-window, and revocation records are now frozen with their retained and canonical-wire digests. Executable vectors verify payload redaction, strict source and duration decoding, schema closure, and tamper rejection.

A closed audit now classifies all 555 public root types: 307 typed readers, two output-only producers and 246 reviewed Rust-only instantiations. It pins 308 input/default and 308 serialization schemas. Earlier readers retain 38 value types and 67 execution types mapped to positive and negative evidence. Complete graph, checkpoint, invocation, outbox and wait wires retain the earlier constructor digests. Empty tagged variants reject additional fields and sequence forms while valid wire bytes and seven generated schema pins remain unchanged. Forty-four bounded property models also run with a reproducible CI seed. Nested JSON has independent six-dimension resource and UTF-16 canonical-tree models; opaque and schema-bound extensions revalidate previously wider values when limits tighten. Seven composite budget models independently check all 20 usage fields, partial limits, currency intersections, direct-plus-child reservations and exact remaining capacity using wide arithmetic. Per-field overflow, deadline equality, unknown costs and an unlisted zero-cost currency fail closed; successful paths run in every capacity sample.

Two graph and checkpoint models independently check state, route union, canonical bytes and all three checksum preimages. Node insertion and result input order preserve the same committed facts and journal anchors. Unicode state chains bind one to thirteen parent generations and reject tampered data. These pure root-barrier checks retain the separate database and same-Run nested-execution gates; RFC-0002 remains Draft.

Timestamp readers reject every ASCII non-digit at all 20 digit positions, fixed-length Unicode and a retained malformed nested Run transition. Decimal arithmetic follows digit validation in every build profile; valid timestamp bytes, ranges and schema pins stay exact.

All 181 closed object readers require maps, including nested schema references in Tool, Agent, journal, checkpoint and child records. Text and Value controls reject full, empty, truncated and extended positional arrays. Use the object shape from the pinned schema; sequence-based binary-format decoding is unsupported. Valid wire bytes, the 43 prior fixtures and both 308-pin profiles stay exact. The actual Tool registry rejects malformed nested input before application dispatch. This source-only correction does not change the published alpha.1 package.

CI rejects missing, unregistered, changed, duplicate, unsafe, oversized, or unreferenced fixtures. Every entry must remain consumed by executable Rust compatibility tests. This is auditable infrastructure toward RFC-0001 validation item 2. Current root types have explicit fixture pointers and compiler evidence; optional/nested combinations, composite properties and historical qualification retain their separate acceptance gates; item 2 remains open for the remaining review.

A separate sealed matrix covers every alternative of all 71 serialized public enums: 298 canonical wires and digests, including 28 previously missing constructor cases. Its 73 checks compare the typed inventory and generated schema cases, reject arrays/unknown fields/raw duplicate keys, and preserve the 43 earlier documents. Both fuzz schema oracles and fixed seed replay exercise every alternative. These are current-source vectors; optional/nested combinations and actual historical releases remain separate work. Existing product bytes, pins and dependencies are unchanged.

Run bounded fuzz qualification

An isolated dev workspace runs ASan/libFuzzer against bounded JSON/JCS, all 307 readers and the actual offline schema registry. Every seed is explicitly replayed before at most 10,000 executions or 60 seconds of mutation per target, with a 128 KiB input bound, 10-second input deadline and 2,048 MiB RSS ceiling. CI retains failures and coverage cases. The final immutable source must pass Core bounded fuzz. Accepted input is checked against its offline input schema after actual deserialization; producer output retains its separate schema oracle.

python3 fuzz/qualify.py

The repository fuzz/README.md provides pinned tools and full reproduction steps. Output schemas use actual serializer wires; existing input pins stay exact. Stale output pins fail at startup with zero application calls. Changed bytes require new schema/Tool versions and the old registry for admitted work. Finite fuzz does not establish exhaustive variants, historical migration, production capacity or independent security acceptance.

Cross the production boundary deliberately

A real host must still authenticate and authorize the caller, resolve immutable tenant-owned descriptors and schemas, commit durable admission, execute external attempts through the ledger, drive checkpoints under lease and fencing, and revalidate terminal evidence. Continue with the typed Agent guide; none of those responsibilities are hidden in these core examples.